Debunking Abbott’s “server timestamp” claims

Update:The ABC has examined the computer used to send the PDF document, and appears to have verified that there was a time stamp error with the Department of Parliamentary Services. Sortius’ analysis is still useful, but it appears at this stage that Abbott was correct that there was an incorrect timestamp on the computer.

blog Unless you live in an area of Australia where it’s impossible to get television or radio reception (an idea which has seemed attractive to your writer at times, in the current media environment), it would have been hard to escape the news that a Federal Court judge has thrown out the sexual harassment case against former Federal House of Representatives Speaker Peter Slipper. But it’s one particular comment by Opposition Leader Tony Abbott that has Australia’s IT industry perking up its ears this morning.

“So Abbott has been caught with his hand in the conspiracy jar & the first place he decided to go was with the IT problem angle. Having worked in the industry for a long time (almost 20 years), I felt it was my duty to explain how Abbott’s line that “during April the computer server timestamps were sometimes out by up to 10 hours” was wrong, & why it was at best improbably, at worse, impossible.”

Sortius’ investigation of this issue is quite persuasive; Abbott’s comment struck your writer from the start as being wrong … I would find it very hard to believe indeed that a computer server error at Parliament House or elsewhere could cause this kind of datestamp change. Abbott’s explanation might have flown in 1995, but in 2012, with most PCs setting their clocks automatically from Internet-hosted time servers? It seems hard to believe that many PCs could be 10 hours out of date.

Image credit: Screenshot of Tony Abbott on the 7:30 Report, believed to be OK to use under fair use

Yes Sortius has a PDF created by the same user (mcdulingg) submitted from the day before clearly showing “+10’00′” (AEST) time zone. So that’s that, The date has been modified on the 23/04/12 to attempt to show the time zone as UTC.

“.. obviously, my parties desperate, complicit acts committed in yet another bone-headed, jerk-wad attempt to lie and cheat our way into power by yet again, failing to destabilise the government — was a dicky clock on a com-pute-or.”

Abbott’s veracity is not really important – he could never hope to compete with our incumbent leader in that regard.
The practical point is that Gillard obviously feels that Slipper is now vindicated and would presumably be an excellent role-model for our children.

Abbott caught lying again? Who would’ve thought….or is it a case of him being passed on shifty and false information from his staffers? The same staffers who may be running our country by the end of next year!!!! Reason to worry.

There’s certainly something weird going on. I asked a friend (who has Microsoft Office Word 2007, the exact same version supposedly used by the Liberals) and they opened up an existing DOC file (old file from years ago) and exported to PDF. Two interesting results:

[1] You do NOT get the “Zulu” timestamp, you get a +11’00’ timestamp (AEDT).

[2] Both the “Created On” timestamp and the “Last Modified” timestamp came out EXACTLY THE SAME right down to the second. It does not in any way tell you when the DOC file was really created.

I checked the Sortius metadata image and [1] and [2] are true for that example as well, either Sortius is a fast typist, or else this metadata does not normally provide any information about when the document was created. So what process actually generates a “Created On” timestamp that is in any way different to the “Last Modified” timestamp?

Sortius:The last ditch effort for Abbott would be the files being created locally on a computer that’s 10hrs out, then moved to the files to the server. This, however, would still show the actual time of creation according to the server time zone, not the client.

That sounds like a load of cobblers. I don’t believe there is any fileserver in the world (even from Microsoft) that would reach into a PDF and start rummaging around with the metadata. Yes, the fileserver would update its own filesystem metadata and directory timestamps, but the guts of the PDF are just bytes to store as far as the server is concerned.

It is just vaguely possible that if the PDF is actually created on the network drive then Microsoft Word might pull back metadata from the server rather than using the local clock, in which case maybe the server works in Zulu time and the client picks that up. I haven’t got the right gear to test this theory, but plenty of sysadmins prefer Zulu time for more reasons than I care to list right now.

Also, we don’t actually know it was a Microsoft server. So all that Kerberos stuff is speculative.

Sortius:So that’s that, the date has been modified on the 23/04/12 to attempt to show the time zone as UTC.

Possible, but highly implausible. Given that the default behaviour is for both dates to be exactly the same (thus not showing the true creation date), why would any bad guy nefariously attempt to set themselves up with a false trail that points to themselves? Doesn’t make any sense whatsoever. Why edit the creation date and deliberately set it back? Nuts! A clever criminal would not make such a stupid mistake, and a stupid criminal would not even get the idea into their head that this was worth doing.

Yeah, something weird is going on, and none of the theories presented actually fit the evidence.

NB: I removed the magic characters in “Creator” and “Producer” so it would post as plain ASCII, but the timestamps were already in plain ASCII.

There is no time zone at all on the parlinfo pages, and also note identical creation and modified dates thus, no real data about when it was created. Still no theory that matches the available evidence.

Tel on my MAC i use Finder and in the window i can click on any doc and it shows me the created , last modified , last opened dates and times …. i use Office for mac 2011 as part of pic say and below i pasted a screen shot minus personal details of a old doc showing dates

Sure, but suppose you were sending out a press release, you aren’t going to put your Mac into a post pack and encourage the person at the other side to look at it in finder. You would just send out the PDF, probably either by email, or by uploading to some server right?

Well, the metadata that gets embedded in the PDF is the important thing here, unless we get hold of the original hard drive to examine (and that’s highly unlikely).

What I’m saying is that under a normal export situation (tested under Windows PC), both timestamps would be identical, and both would be the timestamp of the export operation. The real document creation date does not seem to get copied through with the export (not with Word 2007, and not with Word 2010 either).

What’s more, on the parlinfo server, the PDF files show the same property — both timestamps are identical to each other.

So why would anyone in their right mind go and edit this? For a person trying to hide their tracks, the job requires no effort at all because Microsoft’s PDF export engine already hides the true creation date. Only the original DOC file would keep this metadata. Do you see what I’m getting at?

If you are suggesting they did the export to PDF some days ahead of time, and then edited the PDF at the last minute, would they really be so amazingly clueless as to deliberately edit in a bogus timezone on the creation date, but then leave that creation date with bogus timezone rather than just edit BOTH dates?

It would require someone deliberately attempting to screw up?!?

That or some other process has happened here adjusting PDF timestamps (but I can’t think what that would be).

I have not tested how this behaves on a networked drive… and just maybe there is some server process that does legitimately tinker with the PDF metadata (not impossible).

The only thing that plausibly makes sense is that Abbott’s office was talking about the 10 hour difference being the Canberra time zone offset, thus the server was not really broken, nor was the time actually wrong, it was just working in either GMT or UTC time. Entirely possible that someone in Tony Abbott’s office gave an off the cuff remark about a 10 hour difference, and by the time it got though the Chinese Whisper process, the newspaper didn’t bother reporting that it was just the normal timezone offset. No conspiracy, just incompetence. Happens all the time.

Maybe they have some strange plug-in that changes the PDF export behaviour of Microsoft Office?

“So what process actually generates a “Created On” timestamp that is in any way different to the “Last Modified” timestamp?”

Modifying the PDF itself would do this. He suggest this in one of his edits:

“have tested to see if a document created within UTC time zone would output with a Z as the time zone code, it will not when exported for MS Word, the time zone code defaults to “+00’00′”, the only time you will get a Z time zone denotation is if you export via Adobe Acrobat itself & not with the Microsoft Word PDF export. ”

This would indicate that the original DOC was not changed, but the PDF itself was.

Yes exactly, it would require the PDF itself to be modified, but who or what would do that?

What possible motivation would any of Abbott’s staff have to edit in an obviously bogus creation date? Only someone who deliberately wants to make a mess of it would do that. Even if they thought they really were hiding their tracks somehow, why not just edit in a later creation date to match the News Ltd story? Why use the Zulu timezone?

Parliments server is a pidgeon with a note around it’s leg. I believe that could have got side tracked by some seed on the ground or courting another bird which could have taken 10 hours…..
Time to upgrade to Raven’s I think!

Crux of the story is texts were sent both ways , Half the Coalition front bench were meeting with Ashby yet all denied it until pressed .. Why ? … Abbott has lied about his involvement all the way along so the time line is very important as it shows he was aware and involved ahead of a supposedly exclusive article on Ashby …

How could this happen why and what purpose … That is the questions as it all leads to setting up Slipper who was speaker of the Govt and to setting up Govt itself which is a serious charge

So what? Thjey sent rude text back and fowards to one another. Big deal. People do it every day.
I think the big deal is why it after all these years became an issue? Why did this guy who had been receiving these texts and sending them suddenly decide sexual harasment now? Why was so much ‘evidence’ brought up at the pre hearing and used by the Coalition in parliment to attack Slipper never actually exist? It was like the whole pre trial was to set up a series of allegations for the Coalition to use. They were pointless for the courtcase as if the evidence isn’t brought foward the judge will ignore it. You don’t bring foward enough and the judge will give you a right bollocking. Have a LOT of accusations you suddenly have not evidence for but have been used to wreck someones political career, you get what happened today. There may be fallout from this for the lawyer at least, Tony may dodge and weave, called on parlimentary privilage, have the story buried by News Ltd, as usual, and survive.

Ashby & Co brought more smear , innuendo and lies to the court case then they did facts for the sexual harassment case and made this available to the media / LNP for political purposes , The judge saw this and ruled accordingly .. Why bring up allegation and make them to media then retract later on ..

It was al done to hurt slipper no matter the outcome hence why Steve UTEGATE Lewis was involved

Amazes me after all that has been revealed and a judge has made a damning expose` there are still people trying to cling onto desperate hopes that the Torys are all so blameless and pure as Mother Teresa.
Today Abbott was caught out as he lied about when he knew about the news release of Ashbys now defeated absurd accusations against Slipper. He blamed a 10 hr fault on the time clocks of the Parliament Bldgs computer system.
Sick Tony sick. Come home son and face the music, liar
Greg by the way, there are many of Ashbys text messages not yet released. Social media, who discovered the Abbott lie about his computer are on to that as well.

I hope these idiots who are attacking the judge appreciate the consequences of contempt of court. I doubt they do and I gather this Federal Court Judge is not a man to be trifled with. Be it on their heads

The latest version of Microsoft’s Windows operating system will begin rolling out from Wednesday (July 29). And remarkably, Windows 10 will be offered as a free upgrade to those users who already have Windows 7 and 8.1 installed.

Two sizable Queensland Government departments have no central disaster recovery plan, the state’s Auditor-General has found, despite the region’s ongoing struggles with extreme weather conditions that have previously knocked out telecommunications and data centre infrastructure.

The Australian Signals Directorate appears to have released a guide to hardening Microsoft’s Windows 8 operating system, three years after the software was released for use by corporate customers, and as Microsoft is slated to release its next upgrade, Windows 10.

Perth-headquartered IT services group ASG this week revealed it had picked up a deal worth at least $35 million over five years with CIMIC Group — the massive construction and contracting group previously known as Leighton Holdings.